<html>
<head><meta charset="utf-8"><title>Relying on drop running · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html">Relying on drop running</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="166393771"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166393771" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166393771">(May 23 2019 at 19:50)</a>:</h4>
<p>AFAIK it is well-accepted that you can rely on drop glue running <em>in your own code</em>, as that is not impeded by <code>mem::forget</code>. However, just recently someone was surprised by this, and now someone is <a href="https://github.com/japaric/microamp/issues/6#issuecomment-493972302" target="_blank" title="https://github.com/japaric/microamp/issues/6#issuecomment-493972302">actively doubting it</a>. Does someone here know examples of libraries relying on this? I thought crossbeam did, but it uses <code>catch_unwind</code> instead. I found <a href="https://github.com/rust-lang/rust/blob/27cc0db7a248308fc2634ac68d7608a20b4a1c09/src/liballoc/vec.rs#L685" target="_blank" title="https://github.com/rust-lang/rust/blob/27cc0db7a248308fc2634ac68d7608a20b4a1c09/src/liballoc/vec.rs#L685">one case in libstd</a>.</p>



<a name="166478981"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166478981" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166478981">(May 24 2019 at 18:39)</a>:</h4>
<p>Stack-allocated GC rooting is a good example of this, e.g. providing an unsafe rooting API but then wrapping it in a macro that ensures the user can't call <code>mem::forget</code>.</p>



<a name="166479451"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166479451" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166479451">(May 24 2019 at 18:45)</a>:</h4>
<p><span class="user-mention" data-user-id="128323">@Alan Jeffrey</span> ah, josephine is doing that these days, right?</p>



<a name="166479588"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166479588" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166479588">(May 24 2019 at 18:48)</a>:</h4>
<p>hm, can't find that macro in josephine's docs?</p>



<a name="166670018"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166670018" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166670018">(May 27 2019 at 22:58)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> see also binary_heap::Hole: <a href="https://github.com/rust-lang/rust/blob/27cc0db7a248308fc2634ac68d7608a20b4a1c09/src/liballoc/collections/binary_heap.rs#L924-L983" target="_blank" title="https://github.com/rust-lang/rust/blob/27cc0db7a248308fc2634ac68d7608a20b4a1c09/src/liballoc/collections/binary_heap.rs#L924-L983">https://github.com/rust-lang/rust/blob/27cc0db7a248308fc2634ac68d7608a20b4a1c09/src/liballoc/collections/binary_heap.rs#L924-L983</a></p>



<a name="166670041"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166670041" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166670041">(May 27 2019 at 22:59)</a>:</h4>
<p>hashbrown::ScopeGuard: <a href="https://github.com/Amanieu/hashbrown/blob/master/src/scopeguard.rs" target="_blank" title="https://github.com/Amanieu/hashbrown/blob/master/src/scopeguard.rs">https://github.com/Amanieu/hashbrown/blob/master/src/scopeguard.rs</a></p>



<a name="166670175"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166670175" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Gankra <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166670175">(May 27 2019 at 23:01)</a>:</h4>
<p>...every user of the scopeguard crate: <a href="https://crates.io/crates/scopeguard/reverse_dependencies" target="_blank" title="https://crates.io/crates/scopeguard/reverse_dependencies">https://crates.io/crates/scopeguard/reverse_dependencies</a></p>



<a name="166691346"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166691346" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166691346">(May 28 2019 at 07:50)</a>:</h4>
<p>Relying on this _for safety_ ? Or just relying on this? E.g. <code>Box</code> relies on this..</p>



<a name="166691351"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166691351" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166691351">(May 28 2019 at 07:50)</a>:</h4>
<p>for not leaking memory</p>



<a name="166691366"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166691366" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166691366">(May 28 2019 at 07:51)</a>:</h4>
<p>if the user does not explicitly leak memory (e.g  by writing <code>mem::forget</code>)</p>



<a name="166691932"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166691932" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166691932">(May 28 2019 at 08:00)</a>:</h4>
<p>I was looking for safety cases</p>



<a name="166691955"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166691955" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166691955">(May 28 2019 at 08:01)</a>:</h4>
<blockquote>
<p>Stack-allocated GC rooting is a good example of this, e.g. providing an unsafe rooting API but then wrapping it in a macro that ensures the user can't call <code>mem::forget</code>.</p>
</blockquote>
<p><span class="user-mention" data-user-id="128323">@Alan Jeffrey</span> do you have a link for this?</p>



<a name="166715308"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166715308" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166715308">(May 28 2019 at 13:17)</a>:</h4>
<p>For Josephine I think the plan is to use the JS context and rooting scopes to avoid a magic macro, as discussed here: <a href="https://github.com/asajeffrey/josephine/issues/52" target="_blank" title="https://github.com/asajeffrey/josephine/issues/52">https://github.com/asajeffrey/josephine/issues/52</a></p>



<a name="166715408"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166715408" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166715408">(May 28 2019 at 13:18)</a>:</h4>
<p>the use of a macro is something I've discussed a lot with nox, let me ping him and see if there's anything written down.</p>



<a name="166715542"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166715542" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166715542">(May 28 2019 at 13:19)</a>:</h4>
<p>The basic idea is a macro which enforces that you can only create a <code>Foo</code> via <code>let ref mut x = Foo::new()</code>, so the caller doesn't have a owned <code>Foo</code> they can <code>mem::forget</code>, <code>ManuallyDrop</code> etc.</p>



<a name="166715592"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166715592" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166715592">(May 28 2019 at 13:20)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> ^</p>



<a name="166716685"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166716685" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166716685">(May 28 2019 at 13:30)</a>:</h4>
<p>yes that's what I imagined, I just thought that would already be implemented</p>



<a name="166716757"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166716757" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166716757">(May 28 2019 at 13:31)</a>:</h4>
<p>if not, could you speak up in <a href="https://github.com/rust-lang-nursery/nomicon/issues/135" target="_blank" title="https://github.com/rust-lang-nursery/nomicon/issues/135">https://github.com/rust-lang-nursery/nomicon/issues/135</a> and cite that as a usecase?</p>



<a name="166716828"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166716828" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166716828">(May 28 2019 at 13:31)</a>:</h4>
<p>I was confused for a sec here but the <code>Pin</code> in <a href="https://github.com/asajeffrey/josephine/issues/52" target="_blank" title="https://github.com/asajeffrey/josephine/issues/52">https://github.com/asajeffrey/josephine/issues/52</a> is not the one in libstd right?^^</p>



<a name="166717435"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying%20on%20drop%20running/near/166717435" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Alan Jeffrey <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Relying.20on.20drop.20running.html#166717435">(May 28 2019 at 13:37)</a>:</h4>
<blockquote>
<p>I was confused for a sec here but the <code>Pin</code> in <a href="https://github.com/asajeffrey/josephine/issues/52" target="_blank" title="https://github.com/asajeffrey/josephine/issues/52">https://github.com/asajeffrey/josephine/issues/52</a> is not the one in libstd right?^^</p>
</blockquote>
<p>yeah, Josephine's <code>Pin</code> predates the one in std.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>